Last updated: 1 October 2026
1. Who we are
This website is run by TonnyCaan Infotech Limited, a company registered in England and Wales (company number 11802397), at 668 Rochdale Road, Manchester, M9 5TT, United Kingdom. We are the data controller for the personal information described in this policy.
We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
If you have any questions about this policy or your information, contact us at info@tonnycaan.com, call +44 7988 210624, or write to the address above.
2. Information we collect
When you contact us
If you use a contact form, we collect your name, email address, phone number, your message and the page you sent it from. We also record your device’s IP address so we can stop spam and abuse.
When you place an order
We collect your name, email address, phone number, delivery address, any order notes, and the products you buy. Payments are handled by Stripe: you enter your card details on Stripe’s secure payment page, and we never see or store your full card number. Stripe tells us whether the payment succeeded and gives us a payment reference.
When you create an account
We collect your name, email address and password. Your password is stored only in an encrypted (hashed) form that no one, including our staff, can read. If you choose to, we also store your phone number and delivery address. We record when you last signed in, and the orders you place while signed in.
Technical information
To protect accounts, we briefly record the IP address and email used for failed sign-in attempts, so we can block repeated password guessing.
3. How we use your information
| What we use it for | Our legal basis (UK GDPR) |
|---|---|
| Processing, delivering and supporting your orders, including order confirmation emails | Performance of a contract with you |
| Running your account, confirming your email address, showing your order history, and sending password-reset codes | Performance of a contract with you |
| Replying to your enquiries | Our legitimate interests in responding to people who contact us |
| Preventing fraud, spam and unauthorised access to accounts | Our legitimate interests in keeping our website and customers safe |
| Keeping accounting and tax records of sales | Legal obligation |
We do not sell your information, and we do not send marketing emails. If we offer a newsletter in future, we will only send it if you choose to sign up.
4. Who we share it with
We share your information only with the service providers we need to run the website and our business:
- Stripe Payments UK Ltd: processes card payments and sends payment receipts. See Stripe’s privacy policy.
- [Hosting company name]: hosts our website, database and email.
- Google: provides the fonts used on this website and the map on our Contact page. Your browser connects to Google to load these, which shares your IP address with Google. See Google’s privacy policy.
- Delivery couriers: receive your name, delivery address and phone number so they can deliver your order.
We may also share information if the law requires it, for example with HMRC or the police.
Some of these providers may process information outside the UK. Where they do, they protect it with safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement or adequacy regulations.
5. Cookies & browser storage
We only use what is strictly necessary for the website to work. We do not use advertising or analytics cookies, so we don’t ask for cookie consent.
| Name | Purpose | How long |
|---|---|---|
tc_customer | Keeps you signed in to your customer account | Until you close your browser or sign out |
tc_admin | Keeps our staff signed in to the shop dashboard | Until the browser closes or sign-out |
tc_cart_v1 (browser storage) | Remembers what’s in your shopping cart | Until you check out or clear it |
The map on our Contact page is provided by Google, which may set its own cookies when the map loads.
6. How long we keep your information
- Orders: 6 years from the end of the financial year, as required for UK tax and accounting records.
- Accounts: until you delete your account. You can do this yourself at any time under My Account → Password & privacy. Your past orders are then kept only for the period above and are no longer linked to you.
- Enquiries: as long as needed to deal with your enquiry, and no longer than [24 months].
- Failed sign-in records: deleted automatically after 24 hours.
- Email verification and password-reset codes: expire after 15 minutes, work only once, and are deleted within 2 days.
7. How we protect your information
This website uses encrypted (HTTPS) connections. Passwords are stored only as secure hashes. Access to customer information is limited to authorised staff using individual accounts. Card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1, the highest standard in the payments industry.
8. Your rights
Under UK data protection law, you have the right to:
- Access a copy of the information we hold about you
- Correct anything that is wrong. You can update your account details yourself in My Account
- Delete your information. You can delete your account yourself, or ask us
- Restrict or object to how we use your information
- Data portability: receive your information in a common format
To use any of these rights, email info@tonnycaan.com. We will reply within one month. There is normally no charge.
If you’re unhappy with how we’ve handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
9. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.